Source: capnproto Version: 1.1.0-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for capnproto. CVE-2026-32239[0]: | Cap'n Proto is a data interchange format and capability-based RPC | system. Prior to 1.4.0, a negative Content-Length value was | converted to unsigned, treating it as an impossibly large length | instead. In theory, this bug could enable HTTP request/response | smuggling. This vulnerability is fixed in 1.4.0. CVE-2026-32240[1]: | Cap'n Proto is a data interchange format and capability-based RPC | system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a | chunk's size parsed to a value of 2^64 or larger, it would be | truncated to a 64-bit integer. In theory, this bug could enable HTTP | request/response smuggling. This vulnerability is fixed in 1.4.0. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-32239 https://www.cve.org/CVERecord?id=CVE-2026-32239 https://github.com/capnproto/capnproto/security/advisories/GHSA-qjx3-pp3m-9jpm [1] https://security-tracker.debian.org/tracker/CVE-2026-32240 https://www.cve.org/CVERecord?id=CVE-2026-32240 https://github.com/capnproto/capnproto/security/advisories/GHSA-vpcq-mx5v-32wm [2] https://github.com/capnproto/capnproto/commit/2744b3c012b4aa3c31cefb61ec656829fa5c0e36 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
